Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 08:24
Static task
static1
Behavioral task
behavioral1
Sample
e13857401eb5c43d18a498712188ed15.exe
Resource
win7-20231129-en
General
-
Target
e13857401eb5c43d18a498712188ed15.exe
-
Size
4.1MB
-
MD5
e13857401eb5c43d18a498712188ed15
-
SHA1
36c7e59d35b366e2b50f90dcfa7725ac69004ca4
-
SHA256
a1709149461b53bc54bcda054a1948e62a92b7fe08f56518d224f531cc400130
-
SHA512
05f49545ae3df23de965eaa356d546631f4e25ca8fcf207c6afc2a28e2d3406276ffe1cdb14ecdbb0043246545771095f5f45395ec50ae03caf429882ab7192d
-
SSDEEP
98304:EGPZgrQmhBXdbkuMl1IVhAKWmfP1QWGx5oPj83L2jNrGn:TPZgrQmhBXhMsVAmfP1zGx5oPj8368
Malware Config
Extracted
bitrat
1.38
194.5.98.113:1234
-
communication_password
bff18ee01e25cc7e9bfe4d873f6104ea
-
tor_process
tor
Signatures
-
Processes:
e13857401eb5c43d18a498712188ed15.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e13857401eb5c43d18a498712188ed15.exe -
Processes:
e13857401eb5c43d18a498712188ed15.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths e13857401eb5c43d18a498712188ed15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\e13857401eb5c43d18a498712188ed15.exe = "0" e13857401eb5c43d18a498712188ed15.exe -
Processes:
e13857401eb5c43d18a498712188ed15.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths e13857401eb5c43d18a498712188ed15.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions e13857401eb5c43d18a498712188ed15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\e13857401eb5c43d18a498712188ed15.exe = "0" e13857401eb5c43d18a498712188ed15.exe -
Processes:
e13857401eb5c43d18a498712188ed15.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e13857401eb5c43d18a498712188ed15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e13857401eb5c43d18a498712188ed15.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
e13857401eb5c43d18a498712188ed15.exepid process 2580 e13857401eb5c43d18a498712188ed15.exe 2580 e13857401eb5c43d18a498712188ed15.exe 2580 e13857401eb5c43d18a498712188ed15.exe 2580 e13857401eb5c43d18a498712188ed15.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e13857401eb5c43d18a498712188ed15.exedescription pid process target process PID 2244 set thread context of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
e13857401eb5c43d18a498712188ed15.exepowershell.exee13857401eb5c43d18a498712188ed15.exedescription pid process Token: SeDebugPrivilege 2244 e13857401eb5c43d18a498712188ed15.exe Token: SeDebugPrivilege 2372 powershell.exe Token: SeDebugPrivilege 2580 e13857401eb5c43d18a498712188ed15.exe Token: SeShutdownPrivilege 2580 e13857401eb5c43d18a498712188ed15.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e13857401eb5c43d18a498712188ed15.exepid process 2580 e13857401eb5c43d18a498712188ed15.exe 2580 e13857401eb5c43d18a498712188ed15.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
e13857401eb5c43d18a498712188ed15.exedescription pid process target process PID 2244 wrote to memory of 2372 2244 e13857401eb5c43d18a498712188ed15.exe powershell.exe PID 2244 wrote to memory of 2372 2244 e13857401eb5c43d18a498712188ed15.exe powershell.exe PID 2244 wrote to memory of 2372 2244 e13857401eb5c43d18a498712188ed15.exe powershell.exe PID 2244 wrote to memory of 2372 2244 e13857401eb5c43d18a498712188ed15.exe powershell.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe PID 2244 wrote to memory of 2580 2244 e13857401eb5c43d18a498712188ed15.exe e13857401eb5c43d18a498712188ed15.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e13857401eb5c43d18a498712188ed15.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e13857401eb5c43d18a498712188ed15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e13857401eb5c43d18a498712188ed15.exe"C:\Users\Admin\AppData\Local\Temp\e13857401eb5c43d18a498712188ed15.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e13857401eb5c43d18a498712188ed15.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e13857401eb5c43d18a498712188ed15.exe"C:\Users\Admin\AppData\Local\Temp\e13857401eb5c43d18a498712188ed15.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2244-1-0x0000000074090000-0x000000007477E000-memory.dmpFilesize
6.9MB
-
memory/2244-2-0x0000000001110000-0x0000000001150000-memory.dmpFilesize
256KB
-
memory/2244-3-0x0000000004EF0000-0x0000000005304000-memory.dmpFilesize
4.1MB
-
memory/2244-24-0x0000000074090000-0x000000007477E000-memory.dmpFilesize
6.9MB
-
memory/2244-0-0x00000000008A0000-0x0000000000CBE000-memory.dmpFilesize
4.1MB
-
memory/2372-15-0x000000006ECA0000-0x000000006F24B000-memory.dmpFilesize
5.7MB
-
memory/2372-25-0x000000006ECA0000-0x000000006F24B000-memory.dmpFilesize
5.7MB
-
memory/2372-21-0x0000000002980000-0x00000000029C0000-memory.dmpFilesize
256KB
-
memory/2372-19-0x000000006ECA0000-0x000000006F24B000-memory.dmpFilesize
5.7MB
-
memory/2372-17-0x0000000002980000-0x00000000029C0000-memory.dmpFilesize
256KB
-
memory/2580-22-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-29-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-12-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-9-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-18-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-8-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-14-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2580-7-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-6-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-23-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-5-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-4-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-26-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-27-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-28-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-13-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-30-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-31-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-32-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-33-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-34-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-35-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-36-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-37-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-38-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-39-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-40-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-41-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB
-
memory/2580-42-0x0000000000400000-0x00000000007CF000-memory.dmpFilesize
3.8MB